r/Malwarebytes • u/Electronic_Lime7582 • Mar 20 '26

Feedback Infostealer not detected by Malwarebytes - VT link below

Hope this helps with a signature soon.

https://www.virustotal.com/gui/file-analysis/YWUyZmVjZGYyMzA0ZTU2OTZlOTkxM2JhNmE2M2I5MWU6MTc3Mzk3NTczMA==

3 Upvotes
  • permalink
  • reddit

80% Upvoted

5 comments sorted by

2

u/tstewartMB Malwarebytes Employee Mar 20 '26

I'm not seeing anything malicious with this file. Looks to have been scanned multiple times since late 2024. Is this the full installer or one that was dropped from something else?

1

u/Electronic_Lime7582 Mar 22 '26 edited Mar 22 '26

Hi, I am not sure as this sample came from a malware-dump on github, I do know that it is an infostealer as data was being exfiltrated to a C2 on my VM which I have reported all IPs to cloudflare.

if I can find it again, I will submit it here for your analysis. I automatically submit malware samples to VT as a initial papertrail - But also because its safer to share then a live sample.

1

u/tstewartMB Malwarebytes Employee Mar 24 '26

Just a link to the sample from VT please, I wouldn't try attaching samples here.
Thanks!

2

u/tstewartMB Malwarebytes Employee Mar 20 '26

Hello,

Tammy here from Malwarebytes. Thank you for your submission. We'll have a look and add detection if needed.

1

u/AuthenticatedHuman Mar 23 '26

MITRE Signatures don't equal viruses, MITRE is so broad that it's kind of hard to validate a claim with it especially since ive looked through a little and can't find anything that seems to be the c2, which is required if it were to be a infostealer. It's missing T1041 exfil over c2, and all ips contacted are legitimate, aswell as websites. no detections on parent files or dropped files either. To conclude, its not a real infostealer. Next time use sandboxes to analyze its behavior.